OIDC Login Flow Vulnerability in Budget Board Application by Teelur

CVE-2026-68551

What is CVE-2026-68551?

Budget Board, an application designed for tracking monthly expenses, has a significant security flaw in its OIDC login mechanism prior to version 3.6.2. The vulnerability arises because the system relies solely on the email address from the identity provider's token for account access, omitting any verification of the email's ownership. This oversight opens the door for attackers to maliciously register with a user's email address at a compromised OIDC provider that does not enforce ownership validation. By doing so, the attacker could gain unauthorized access to the victim's Budget Board account, including sensitive financial data linked to the account. This vulnerability has been addressed in version 3.6.2 to enhance security and protect user information.

References